PCI DSS 6.4.2: For public-facing web applications, an automated technical solution is deployed
PCI DSS v4.0.1 control 6.4.2: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 6.4.
Requirement 6: Develop and Maintain Secure Systems and Software › Section 6.4
For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following:
- Is installed in front of public-facing web applications and is configured to detect and prevent web-based attacks.
- Actively running and up to date as applicable.
- Generating audit logs.
- Configured to either block web-based attacks or generate an alert that is immediately investigated.
Summary
Public-facing web applications sit behind something that continually detects and prevents web attacks, running, logging, and either blocking or raising an alert someone acts on immediately.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 6.4.2 | For public-facing web applications, examine the system configuration settings and audit logs, and interview responsible personnel to verify that an automated technical solution that detects and prevents web-based attacks is in place in accordance with all elements specified in this requirement. |
Four elements, and the fourth carries an operational commitment that is easy to accept without noticing: configured to either block web-based attacks or generate an alert that is immediately investigated. Alert-only looks like the safer deployment because it cannot break the application, and it is the heavier obligation, because "immediately investigated" means a capability that exists at three in the morning. Blocking is the option that does not require staffing. Note also generating audit logs as a separate element, which means the solution's logs are in scope for Requirement 10 handling, and actively running and up to date, which is the pair of failures 10.7.2 exists to detect.
What to prepare
- The solution in front of each public-facing application, and configuration showing it is inline.
- Evidence it is actively running and current.
- Its audit logs, and where they are retained.
- If in alert mode, the investigation capability and its response times.
How to implement it
1. Choose blocking unless you can genuinely staff investigation. The alert branch commits you to immediate investigation, and an alert queue reviewed next morning does not meet it.
2. Confirm it is actually inline. A solution deployed and bypassed by a direct origin address protects nothing, and origin exposure is the common architectural mistake.
3. Bring its logs into the Requirement 10 pipeline. They are a named element and they are the record of what was attempted.
4. Monitor it as a critical security control. 10.7.2 covers failures, and a solution that stopped updating is the failure mode this control names.
Where this commonly fails
- Alert mode chosen to avoid breaking the application, with no capacity for immediate investigation.
- The origin reachable directly, so the protection can be bypassed.
- Rules or signatures not maintained, failing the up-to-date element.
- Audit logs generated and discarded, when generating them is a named element.
Related controls
Others in section 6.4:
| Control | What it requires |
|---|---|
| 6.4.1 | For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing… |
| 6.4.3 | All payment page scripts that are loaded and executed in the consumer’s browser… |
← 6.4.1 · All controls · 6.4.3 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.